Configurator

Build your own bundle.

Start with a combo or pick à la carte. Dependencies are added automatically. Your selections are encoded in the URL — share the link and the other party sees the same bundle.

Start with a combo

Pick a preset, then tweak. Tweaking shifts you to "Custom" automatically — your selections are preserved.

Essential€700/yr

For organisations that need the security baseline — and not much else.

Reasonable€2,950/yr

The full ISMS suite, one standard of choice — same price as Cybsis 1.x.

Complete€14,950/yr

Everything Cybsis 2.0 does today — and every paid module Cybsis ships tomorrow.

Custom

Reasonable base, your own selection of modules and standards.

Modules

Paid modules above the Core ISMS base. Dependencies (e.g. Federation needs Multi-Instance) are added automatically.

Sub-instances

Each sub-instance is a separate legal entity sharing the platform. Sold individually at €300/year each. Complete includes 3 sub-instances — any number above that is +€300/year per extra entity.

Total sub-instances

All 3 included in Complete.

Don't know yet? Pick your best guess — the quote comes back with a real number and a note that it can be revised before the invoice goes out.

Standards

The catalogue groups 28 frameworks by category below. One standard is included in the base — each additional pack is €600/year, mapped into your instance on request. No upper limit on concurrent standards.

Cybersecurity & ISMS· 8

E-ITS
The mandatory Estonian information security standard, ~1,600 measures across the catalogue.
Cybsis BaselineAlways included
The essential security baseline, included with every Cybsis installation at no extra charge.
BSI GS++
The German federal information-security baseline — IT-Grundschutz building blocks mapped to a working ISMS, with Basis-, Standard- and Kern-Absicherung scoping.
ISO 27001included
The international ISMS certification standard.
ISO 27005
The risk-management methodology companion to ISO 27001.
ISO 27017 + ISO 27018
The two cloud-specific extensions to ISO 27001 — security controls for cloud services and PII protection in public-cloud processors.
On request · mapped in ~2 weeks
NIST family
The US federal and DoD cybersecurity framework family — Cybersecurity Framework, two control catalogues, and the CMMC maturity model.
On request · mapped in ~2 weeks
NIS2+€600
The EU's flagship cybersecurity directive — risk management, incident reporting, supply-chain security for essential and important entities.

Privacy & data protection· 4

GDPR+€600
The EU's data protection regulation, plus the Article 30 records work.
ISO 27701
The privacy extension to ISO 27001. Bridges ISMS and GDPR with a Privacy Information Management System.
On request · mapped in ~2 weeks
HIPAA
The US healthcare privacy and security regime — Privacy Rule, Security Rule, Breach Notification Rule.
On request · mapped in ~2 weeks
CCPA / CPRA
The Californian consumer privacy regime — the template for the wave of US state privacy laws.
On request · mapped in ~2 weeks

AI governance· 2

EU AI Act + ISO 42001
The EU's risk-tier AI regulation plus the international AI Management System standard. Sold together because the document sets overlap.
NIST AI RMF + Privacy Framework
Two voluntary supplemental NIST frameworks — AI risk management and privacy — using the NIST "Profile" pattern.
On request · mapped in ~2 weeks

Financial sector· 4

DORA
The EU financial-sector operational resilience regulation. ICT risk management, incident reporting, third-party oversight, threat-led penetration testing.
PCI DSS 4.0.1
The payment-card data security standard. Mandatory by card-brand contract for anyone storing, processing, or transmitting cardholder data.
On request · mapped in ~2 weeks
SOX
US public-company internal controls over financial reporting. Section 302/404/906 certifications and IT general controls.
On request · mapped in ~2 weeks
SWIFT CSP
The banking-interconnect security framework. Mandatory annual self-attestation against the Customer Security Controls Framework.
On request · mapped in ~2 weeks

Sector-specific· 3

TISAX
The German automotive information-security framework. Contractually mandatory for suppliers handling OEM information.
On request · mapped in ~2 weeks
ISO 13485
The medical-devices quality management standard. Mandatory for CE marking under EU MDR/IVDR and FDA registration in the US.
On request · mapped in ~2 weeks
NERC CIP
The US/Canada bulk electric system cybersecurity standard. FERC-enforced with civil penalties up to $1M per day per violation.
On request · mapped in ~2 weeks

Quality & integrity management· 2

ISO 9001
The international quality management standard.
ISO 37001
The international anti-bribery management standard. Annex SL family, sells alongside ISO 9001 and ISO 27001.
On request · mapped in ~2 weeks

Environmental & sustainability· 3

ISO 14001
The international environmental management standard.
ISO 50001
The energy-management Annex SL standard. Data feeds the CSRD E1 climate disclosure.
On request · mapped in ~2 weeks
CSRD / ESRS / EU Taxonomy
The EU sustainability reporting regime. Double-materiality assessment + 12 ESRS topical standards + Taxonomy-alignment disclosure.
On request · mapped in ~2 weeks

Business continuity· 1

ISO 22300 series
The business continuity family — BCMS, crisis management, and ICT readiness for business continuity. Sold as one pack.

Audit & assurance· 1

SOC 2
The US enterprise-vendor audit framework. Auditor-driven attestation against the Trust Services Criteria — not a control catalogue.
On request · mapped in ~2 weeks

Need something not in the catalogue?

Industry-specific or sector schemes we don't yet cover. Catalogue ingestion, control mapping, and seeding takes about two weeks, billed as a €600 standards pack.

Where will Cybsis run?

We'd love to run it for you on RW's hosted infrastructure — it lets us push updates the same day they ship, see how the platform is being used so support resolves faster, and means you don't operate the runtime. Self-hosted options are equally welcome.

RW Hosting · AWS eu-north-1+€300/yr

We run it. Same-day updates, usage telemetry so support resolves fast, zero runtime ops on your side. Flat fee regardless of size.

Your cloud — AWS / GCP / AzureNo extra charge

Run the Docker image in your tenancy. You own the runtime; you tell us when an update is welcome. Same product, your infrastructure.

On-premiseNo extra charge

For high-security customers: your data centre, air-gapped if needed. You get the Docker image and documentation; you run it.